28625 - [SC - Insight] Gas griefing is possible on external call
Last updated
Was this helpful?
Last updated
Was this helpful?
Submitted on Feb 22nd 2024 at 17:24:08 UTC by @djxploit for
Report ID: #28625
Report type: Smart Contract
Report severity: Insight
Target: https://etherscan.io/address/0x3C28B7c7Ba1A1f55c9Ce66b263B33B204f2126eA#code
Impacts:
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
If an external calls returns large data, then storing it becomes costly. This will result in paying huge amount of gas for copying the returned data to memory, by the MULTISIGs
In the function executeTransaction
of Timelock.sol
contract, when a transaction is executed through _executeTransaction
function, it returns the status of the low-level call and any returned data.
The data returned by the target
address, i.e returnData
is copied to memory. Now if the size of the returnData
is very large, then the msg.sender
in our case the MULTISIGs, will have to pay a huge amount amount of gas for copying the returned data to memory
target
addresses (malicious actors) can launch a gas griefing attack on MULTISIGs, by returning a huge size of data.
It is recommended to implement the low level call using assembly.
https://solodit.xyz/issues/m-03-gas-griefingtheft-is-possible-on-unsafe-external-call-pashov-none-zerem-markdown
In executeTransaction
function of Timelock.sol
contract